J. 


provided for allowing the selection of one of a plurality of reports for reporting purposes, submitting 
queries to the database utilizing the selected reports for retrieving information on the collection of 
the network usage information from the network devices, and outputting a report based on the 
queries. 


IN THE CLAIMS: 


Please cancel claims 1-31, and add claims 32-4^ as follows: 





\ ) 32. A method for reporting on the collection of network usage information from a 
plurahty of network devices, comprising: 

collecting network communications usage information in real-time ^m a plurality of 
network devices; 

filtering and aggregating the network communications usage information; 
completing a plurality of data records from the filtered and^ggregated network 
communications usage information, the plurality of data Records corresponding to network 
usage by a plurality of users; 
storing the plurality of data records in a database; 

allowing the selection of one of a plurality of reD<5rts for reporting purposes; 
submitting queries to the database utilizing the selected reports for retrieving information on 
the collection of the network usage information from the network devices; and 
outputting a report based on the queries. 

33. A method as recited in claim 32, and further comprising submitting network activity 
queries to the database utilizing the sel^c^ed reports for retrieving information on activity of the 
network. 


34. A method as redted in claim 33, and fiirther comprising outputting a network activity 
report based on the network activity queries. 
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35. A method as recited in claim 32, and further comprising submitting resource 
consumption queries to the database utihzing the selected reports for retrievinganformation on 
resource consumption in the network. 

36. A method as recited in claim 33, and further comprising/outputting a resource 
consumption report based on the resource consumption queries. 

37. A method as recited in claim 33, and further coniffrising generating an alert upon the 
occurrence of an event. 

38. A method as recited in claim 37, wherein J^e alert is generated upon a value 
surpassing a predetermined amount. 


ji 39. A method as recited in claim 37, \ynerein the alert indicates that services should be 

rkceased. 


vy 


40. A method as recited in claim 37, wherein the alert indicates that services should be 


^^provided. 

u 

m 


41 . A method as recitecf in claim 32, wherein the report includes an auditing report. 


42. A method as recited in claim 32, wherein the report includes a billing report. 

43. A method/as recited in claim 32, wherein the report includes an accounting report. 

44. A computer program product for reporting on the collection of network usage 
information from a^luraUty of network devices, comprising: 

(a) computerycode for collecting network communications usage information in real-time from a 
plurality of network devices; 

(b) compmer code for filtering and aggregating the network communications usage information; 
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(c) 


(d) 
(e) 

(f) 


(g) 


computer code for completing a plurality of data records from the filtered and aggregated 
network communications usage information, the plurality of data records c9<Tesponding to 
network usage by a plurality of users; 

computer code for storing the plurality of data records in a database; 
computer code for allowing the selection of one of a plurality of reports for reporting 
purposes; 

computer code for submitting queries to the database utilizing the selected reports for 
retrieving information on the collection of the network us^e information from the network 
devices; and 

computer code for outputting a report based on the qoferies. 


45. A system for reporting on the collectiony6f network usage information from a 
^plurality of network devices, comprising: 

information source modules for collecting/6etwork communications usage information in 
real-time from a plurality of network devices; 

gatherers coupled to the informatioiysource modules, the gatherers adapted for filtering and 
aggregating the network communrcations usage information; 

a central event manager couplea to the gatherers, the central event manager adapted for 
completing a plurality of daj^ records from the filtered and aggregated network 
communications usage information, the plurality of data records corresponding to network 
usage by a plurality of ^sers; 

a database coupled tp the central event manager, the database adapted for storing the plurality 
of data records; ano 

logic for allowi/g the selection of one of a plurality of reports for reporting purposes, 
submitting queries to the database utilizing the selected reports for retrieving information on 
the collectioln of the network usage information from the network devices, and outputting a 
report bashed on the queries. 


w 

in 

l*(b) 

m 

ru 

C3 

(d) 


(e) 


46. / A method for reporting on the collection of network usage information from a 
plurality o/network devices, comprising: 
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# 


(a) 


(b) 


(c) 

13 

!S(d) 


l*(e) 


i(g) 

fs! 

il(h) 

b 


(i) 

G) 

(k) 
(1) 

(m) 


collecting network communications usage information in real-time from network devices at a 
plurality of layers utilizing multiple gatherers each including a pluraUty of information source 
modules each interfacing with one of the network devices and capable of communicating 
using a protocol specific to the network device coupled thereto; the network devices selected 
from the group consisting of routers, switches, firewalls, authentication servers, web hosts, 
proxy servers, netflow servers, databases, mail servers, RADIUS servers, and domain name 
servers, the gatherers being positioned on a segment of ^e network on which the network 
devices coupled thereto are positioned for minimizii]g an impact of the gatherers on the 
network; 

translating the network communications usage information collected from the network 
devices utilizing the information source modules; 

caching the network communications usage information collected from the network devices 
utilizing the gatherers; 

normalizing the network communications usage information with the gatherers by excluding 
fields not required by a central everit manager coupled to the gatherers; 
defining an enhancement procedure utilizing the central event manager; 
coordinating the collection of the network conmiunications usage information by the 
gatherers utilizing the ceirtral event manager; 

filtering the network communications usage information utilizing the central event manager; 
completing a plurality of data records from the filtered network communications usage 
information, the pj^ality of data records corresponding to network usage by a plurality of 
users; 

aggregating rtfe network communications usage information and the data records utilizing the 
central eve/it manager for reducing a number of the data records; 
enhancing the aggregation of the network communications usage information with the 
gatherers in accordance with the defined enhancement procedure; 
timeystamping the data records; 

storing the time stamped data records in tables in a central database coupled to the central 
svent manager at a user-specified interval; 

deleting the stored data records upon the cessation of a predetermined amount of time after 
the storage utilizing the timestamp; 
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